Dell PowerConnect W-IAP3WN User manual

Dell PowerConnect W-Series
Instant Access Point
6.2.0.0-3.2.0.0
User Guide

January 2013 |0511129-03 Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide
Copyright
© 2013 Aruba Networks, Inc. Aruba Networks trademarks include , Aruba
Networks®, Aruba Wireless Networks®, the registered Aruba the Mobile Edge Company logo,
and Aruba Mobility Management System®. Dell™, the DELL™ logo, and PowerConnect™ are
trademarks of Dell Inc.
All rights reserved. Specifications in this manual are subject to change without notice.
Originated in the USA. All other trademarks are the property of their respective owners.
Open Source Code
Certain Aruba products include Open Source software code developed by third parties, including
software code subject to the GNU General Public License (GPL), GNU Lesser General Public
License (LGPL), or other Open Source Licenses. The Open Source code used can be found at this
site:
http://www.arubanetworks.com/open_source
Legal Notice
The use of Aruba Networks, Inc. switching platforms and software, by all individuals or
corporations, to terminate other vendors’ VPN client devices constitutes complete acceptance of
liability by that individual or corporation for this action and indemnifies, in full, Aruba Networks,
Inc. from any and all legal actions that might be taken against it with respect to infringement of
copyright on behalf of those vendors.

3|Contents Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide
Contents
Contents 3
About This Guide 15
Dell PowerConnect W-Instant Access Point Overview 15
Supported Devices 15
Objective 15
Intended Audience 16
Conventions 16
Contacting Support 16
Initial Configuration 17
Initial Setup 17
Pre-Installation Checklist 17
Connecting aW-IAP 18
Assigning an IP Address to the W-IAP 18
Connecting to a Provisioning Wi-Fi Network 18
Disabling the Provisioning Wi-Fi Network 20
Assigning a Static IP 20
Log in to the Dell W-Series Instant UI 21
Specifying a Country Code 21
W-IAP Cluster 22
DellW-Instant User Interface 23
Understanding the Dell W-Series Instant UI Layout 23
Banner 24
Search 24
Tabs 24
Networks Tab 24
Access Points Tab 25
Clients Tab 25
Links 26
New Version Available 27

Settings 27
RF 29
PEF 30
WIP 30
VPN 31
Wired 31
Maintenance 32
Support 32
Help 32
Logout 33
Monitoring 33
Info 33
RF Dashboard 34
Usage Trends 35
Spectrum 36
Overview (Device list) 36
Channel Utilization and Monitoring 36
Channel Details 37
Alerts 37
Client Alerts 37
Fault History 38
Active Faults 38
IDS 39
Configuration 39
AirGroup 40
Language 40
Dell PowerConnect W-AirWave Setup 40
Pause/Resume 41
Views 41
Wireless Network 43
Network Types 43
Employee Network 44
Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide 4|Contents

5|Contents Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide
Adding an Employee Network 44
Voice Network 53
Adding a Voice Network 53
Guest Network 60
Adding a Guest Network 60
Editing a Network 68
Deleting a Network 68
Number of WLAN SSIDs Supported 68
Enabling the Extended SSID Option 69
VLAN Pooling 69
Managing W-IAPs 71
Preferred Band 71
Auto Join Mode 71
Disabling Auto Join Mode 71
Terminal Access 72
LED Display 72
TFTP Dump Server 72
Extended SSID 73
Deny Inter User Bridging and Deny Local Routing 73
Syslog Server 73
Syslog Facility Levels 74
Adding aW-IAP to the Network 74
Removing aW-IAP from the Network 75
Editing W-IAP Settings 75
Changing W-IAP Name 75
Changing IP Address of the W-IAP 76
Configuring Adaptive Radio Management 78
Configuring Uplink Management VLAN 79
Configuring Wired Bridging on Ethernet 0 79
Migrating to a Dell PowerConnect W-Series Mobility Controller Managed Network 80
Converting aW-IAP to RAP Mode 80
Converting aW-IAP to CAP 83

Converting aW-IAP to Standalone Mode 83
Converting Back to aW-IAP 84
Rebooting the W-IAP 84
Firmware Image Server in Cloud Network 86
Upgrade Using Dell PowerConnect W-AirWave and Image Server 86
Image Management Using Cloud Server 86
Image Management Using Dell PowerConnect W-AirWave 86
Automatic Firmware Image Check and Upgrade 87
Upgrading to New Version 88
Manual 88
Automatic 90
Layer-3 Mobility 91
Overview 91
Configuring a Mobility Domain 92
Home Agent Load Balancing 95
Spectrum Monitor 97
Creating Spectrum Monitors and Hybrid APs 97
Converting W-IAPs into Hybrid W-IAPs 97
Converting aW-IAPto a Spectrum Monitor 98
Spectrum Data 100
Overview - Device List 100
Non Wi-Fi Interferers 101
Channel Metrics 103
Channel Details 104
Spectrum Alerts 105
Time Management 107
NTP Server 107
Configuring an NTP Server 107
Daylight Saving Time 108
Enabling Daylight Saving Time 108
Virtual Controller 109
Master Election Protocol 109
Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide 6|Contents

7|Contents Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide
Preference to an IAP with 3G/4G Card 109
Preference to aW-IAP with Non-Default IP 109
Virtual Controller IP Address 110
Specifying Name and IP Address for the Virtual Controller 110
Configuring the DHCP Server 110
Authentication 111
Authentication Methods in DellW-Instant 111
802.1X Authentication 111
Internal RADIUS Server 112
External RADIUS Server 112
Authentication Terminated on W-IAP 112
Configuring an External RADIUS Server 113
Enabling RADIUS Server Support 115
Authentication Survivability 115
RADIUS Server Authentication with VSA 118
List of Supported VSA 118
Management Authentication Settings 120
Captive Portal 121
Internal Captive Portal 121
Configuring Internal Captive Portal Authentication when Adding a Guest Network 122
Configuring Internal Captive Portal Authentication when Editing a Guest Network 123
Configuring Internal Captive Portal with External RADIUS Server Authentication when Adding a Guest
Network 124
Customizing a Splash Page 125
Disabling Captive Portal Authentication 126
External Captive Portal 127
Configuring External Captive Portal Authentication when Adding a Guest Network 127
Configuring External Captive Portal Authentication when Editing a Guest Network 129
External Captive Portal Authentication using ClearPass Guest 131
Creating a Web Login page in the ClearPass Guest 131
Configuring the RADIUS Server in Instant 131
WISPr Authentication 132
Configuring WISPr Authentication 132

MAC Authentication 133
Configuring MAC Authentication 134
Walled Garden Access 134
Creating a Walled Garden Access 134
MAC + 802.1X Authentication 136
Configuring MAC + 802.1X Authentication 136
MAC + Captive Portal Authentication 137
Configuring MAC + Captive Portal Authentication 137
Wired Authentication on aW-IAP 138
Certificates 138
Loading Certificates using Dell W-Series Instant UI 139
Loading Certificates using Dell PowerConnect W-AirWave 140
Encryption 143
Encryption Types Supported in DellW-Instant 143
WEP 143
TKIP 143
AES 143
Encryption Recommendations 143
Understanding WPA and WPA2 144
Recommended Authentication and Encryption Combinations 144
Role Derivation 145
User Roles 145
Creating a New User Role 145
Creating Role Assignment Rules 147
MAC-Address Attribute 147
DHCP Option and DHCP Fingerprinting 148
802.1X-Authentication-Type 148
User VLAN Derivation 149
User VLAN Derivation 149
Vendor Specific Attributes (VSA) 149
VLAN Derivation Rule 150
Configuring VLAN Derivation Rules on aW-IAP 150
Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide 8|Contents

9|Contents Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide
User Role 151
Configuring a User Role 151
SSID Profile 152
Configuring VLAN Derivation Rules Using an SSID Profile 153
Instant Firewall 155
Service Options 156
Destination Options 158
Examples for Access Rules 158
Allow TCP Service to a Particular Network 158
Allow POP3 Service to a Particular Server 159
Deny FTP Service except to a Particular Server 160
Deny bootp Service except to a Particular Network 161
Content Filtering 163
Enabling Content Filtering 163
Enterprise Domains 164
OS Fingerprinting 167
Adaptive Radio Management 169
ARM Features 169
Channel or Power Assignment 169
Voice Aware Scanning 169
Load Aware Scanning 169
Band Steering Mode 169
Airtime Fairness Mode 170
Airtime Fairness Modes 170
Access Point Control 171
Customize Valid Channels 171
Min Transmit Power 171
Max Transmit Power 171
Client Aware 171
Scanning 171
Wide Channel Bands 171
Monitoring the Network with ARM 172

ARM Metrics 172
Configuring Administrator Assigned Radio Settings for W-IAP 172
Configuring Radio Profiles in Instant 173
Intrusion Detection System 177
Rogue AP Detection and Classification 177
Wireless Intrusion Protection (WIP) 177
Containment Methods 181
SNMP 183
SNMP Parameters for W-IAP 183
SNMP Traps 185
Ethernet Downlink 187
Ethernet Downlink Overview 187
Ethernet Downlink Profile Parameters 187
Assigning a Profile to the Ethernet Port 190
Hierarchical Deployment 193
Deployment 193
Uplink Configuration 195
Uplink Interface Configuration 195
Ethernet Uplink 195
3G/4G Uplink 196
Types of Modems 196
Provisioning 3G/4G Uplink Manually 198
Provisioning 3G Uplink Automatically 199
Provisioning a 3G/4G Switch Network 199
Wi-Fi Uplink 200
Provisioning Wi-Fi Uplink 200
Provisioning 3G/4G and Wi-Fi Uplink with Factory Setting 200
Uplink Management 201
Enforce Uplink 201
Uplink Preemption 201
Uplink Switchover 201
Uplink Switching Based on VPN Status 201
Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide 10 |Contents

11 |Contents Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide
Uplink Switching Based on Internet Connectivity Status 202
PPPoE 202
Configuring PPPoE 202
Dell PowerConnect W-AirWave Integration and Management 205
Dell PowerConnect W-AirWave Features 205
Image Management 205
W-IAPand Client Monitoring 205
Template-based Configuration 205
Trending Reports 206
Intrusion Detection System 206
Wireless Intrusion Detection System (WIDS) Event Reporting to Dell PowerConnect W-AirWave 206
RF Visualization Support for DellW-Instant 207
Configuring Dell PowerConnect W-AirWave 207
Creating your Organization String 207
About Shared Key 208
Entering the Organization String and AMP Information into the W-IAP 208
Dell PowerConnect W-AirWaveDiscovery through DHCP Option 208
Standard DHCP option 60 and 43 on Windows Server 2008 208
Alternate Method for Defining Vendor-Specific DHCP Options 212
AirGroup 215
Introducing AirGroup 215
What is Bonjour and Zero Configuration Networking? 215
WLANs and Bonjour 216
AirGroup Solution 216
AirGroup Features 217
Dell PowerConnect W-ClearPass Policy Manager and ClearPass Guest Features 217
AirGroup Architecture 217
How Does AirGroup Work? 218
Use Case: Higher Education Wireless LAN 219
The AirGroup Solution Components 219
Configuring AirGroup on W-Instant 220
Using the Dell W-Series Instant UI 220

Enabling or Disabling AirGroup 220
Disallow Role 221
Disallow VLAN 222
Configuring AirGroup-CPPM Interface in W-Instant 223
Creating a RADIUS Server 223
Assign a Server to AirGroup 224
Configure CPPM to Enforce Registration 225
Change of Authorization (CoA) 225
AirGroup Monitoring 226
Troubleshooting and Log Messages 226
Monitoring 229
Virtual Controller View 229
Monitoring Link 230
Info 230
RF Dashboard 230
Usage Trends 230
Client Alerts Link 232
IDS Link 232
Network View 232
Info 233
Usage Trends 233
DellW-Instant Access Point View 235
Info 235
RF Dashboard 235
Overview 236
Client View 243
Info 244
RF Dashboard 244
RF Trends 244
Mobility Trail 247
Alert Types and Management 249
Alert Types 249
Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide 12 |Contents

13 |Contents Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide
Policy Enforcement Firewall 251
Authentication Servers 251
Users for Internal Server 251
Roles 252
Extended Voice and Video Functionalities 253
QoS for Microsoft Office OCS and Apple Facetime 253
Microsoft OCS 254
Apple Facetime 254
Client Blacklisting 255
Types of Client Blacklisting 256
Manual Blacklisting 256
Adding a Client to the Manual Blacklist 256
Dynamic Blacklisting 257
Authentication Failure Blacklisting 257
Session Firewall Based Blacklisting 257
PEF Settings 258
Firewall ALG Configuration 258
Firewall-based Logging 259
VPN Configuration 261
VPN Configuration 261
Fast Failover 262
Routing Profile Configuration 262
DHCP Server Configuration 263
NAT DHCP Configuration 264
Distributed L2 DHCP Configuration 265
Distributed L3 DHCP Configuration 266
Centralized L2 DHCP Configuration 267
User Database 269
Adding a User 269
Editing User Settings 270
Deleting a User 270
Regulatory Domain 271

Country Codes List 271
Controller Configuration for VPN 277
Whitelist DB Configuration 277
VPN Local Pool Configuration 277
W-IAP VPN Profile Configuration 278
Dell PowerConnect W-ClearPass Configuration for AirGroup 279
Dell PowerConnect W-ClearPass Setup 279
Testing 283
Troubleshooting 283
IAP-VPN 285
Licensing Requirements 285
VPN Configuration 286
Creating aW-IAP Whitelist 286
Controller Whitelist DB 286
External Whitelist DB 286
VPN Local Pool Configuration 287
VPN Profile Configuration 287
Radius Proxy for VPN Connected IAPs 287
Viewing Branch Status 288
Example 288
Troubleshooting 289
Viewing Logs 289
Support Commands 289
Abbreviations 295
Abbreviations 295
Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide 14 |Contents

Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide 15 |About This Guide
Chapter 1
About This Guide
Dell PowerConnect W-Instant Access Point Overview
Thank you for choosing Dell PowerConnect W-Instant Access Point6.2.0.0-3.2.0.0. Dell
PowerConnect W-Instant Access Point virtualizes Dell PowerConnect W-Series
MobilityController capabilities on 802.11n access points (APs), creating a feature-rich enterprise-
grade wireless LAN (WLAN) that combines affordability and configuration simplicity.
Dell W-Instant is a simple, easy to deploy turn-key WLAN solution consisting of one or more
access points. An Ethernet port with routable connectivity to the Internet or a self-enclosed
network, is used to deploy an Instant Wireless Network. An Instant Access Point (W-IAP) can be
installed at a single site or deployed across multiple geographically-dispersed locations. Designed
specifically for easy deployment, and proactive management of networks, Instant is ideal for small
customers or remote locations without any on-site IT administrator.
DellW-Instant consists of an Instant Access Point (W-IAP) and a Virtual Controller (VC). The
Virtual Controller resides within one of the access points. In an Dell W-Instant deployment, only
the first W-IAP needs to be configured. After the first W-IAP is deployed, the subsequent W-IAPs
inherit all the required information from the Virtual Controller.
Supported Devices
The following is a list of Instant devices supported by Dell:
lW-IAP92
lW-IAP93
lW-IAP104
lW-IAP105
lW-IAP134
lW-IAP135
lW-IAP175P/175AC
lW-IAP3WN/3WNP
lW-IAP108
lW-IAP109
NOTE: All APs support an unlimited number of W-IAPs, however W-IAP92 and W-IAP93
support up to 16 W-IAPs only.
Objective
This user guide describes the various features supported by DellW-Instant and provides detailed
instructions for setting up and configuring an DellW-Instant network.

16 |About This Guide Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide
Intended Audience
This guide is intended for customers who configure and use DellW-Instant.
Conventions
The following conventions are used throughout this manual to emphasize important concepts:
Type Style Description
Italics This style is used to emphasize important terms and provide cross-references to
other books.
Screen input and output
This style is used to illustrate:
lScreen output
lOn screen system prompt
lFilenames, software devices, and
specific commands
Bold This style is used to emphasize Instant UI
elements. For example, name of a text box
or the name of a drop-down list.
Table 1 - Conventions
The following informational icons are used throughout this guide:
NOTE: Indicates helpful suggestions, pertinent information, and important things to
remember.
CAUTION: Indicates a risk of damage to your hardware or loss of data.
WARNING: Indicates a risk of personal injury or death.
Contacting Support
Web Site Support
Main Website dell.com
Support Website dell.com/support
Documentation Website dell.com/support/manuals

Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide 17 |Initial Configuration
Chapter 2
Initial Configuration
This section provides information required to setup DellW-Instant and access the Dell W-Series
Instant User Interface.
Initial Setup
This section provides a pre-installation checklist and describes the initial procedures required to
set up DellW-Instant.
Pre-Installation Checklist
Before installing the Instant Access Point (W-IAP), make sure that you have the following:
lEthernet cable of required length to connect the W-IAP to the home router.
lOne of the following power sources:
nIEEE 802.3af/at-compliant Power over Ethernet (PoE) source. The PoE source can be any
power source equipment (PSE) switch or a midspan PSE device.
nDell power adapter kit (this kit is sold separately).
NOTE: PoE is a method of delivering power on the same physical Ethernet wire that is used
for data communication. Power for devices is provided in one of the following two ways:
Endspan— The switch that the W-IAP is connected to can provide power.
Midspan— A device can sit between the switch and the W-IAP.
The choice of endspan or midspan depends on the capabilities of the switch to which the
IAP is connected. Typically if a switch is in place and does not support PoE, midspan power
injectors are used.
NOTE: A DNS server functions as a phonebook for the internet and internet users. It converts
human readable computer hostnames into IP addresses and vice-versa. A DNS server stores
several records for a domain name, such as an address 'A' record, name server (NS), and
mail exchanger (MX) records. The Address 'A' record is the most important record that is
stored in a DNS server because it provides the required IP address for a network peripheral
or element.
The Dynamic Host Configuration Protocol (DHCP) is an auto-configuration protocol used on
IP networks. Computers or any network peripherals that are connected to IP networks must
be configured before they can communicate with other computers on the network. DHCP
allows a computer to be configured automatically, eliminating the need for a network
administrator. DHCP also provides a central database to keep a track of computers
connected to the network. This database helps in preventing any two computers from being
configured with the same IP address.
To complete the initial setup, perform the following tasks in the given order:
1. "Connecting aW-IAP" on page 18

18 |Initial Configuration Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide
2. "Assigning an IP Address to the W-IAP" on page 18
3. "Connecting to a Provisioning Wi-Fi Network" on page 18
4. "Log in to the Dell W-Series Instant UI" on page 21
5. "Specifying a Country Code " on page 21 — Skip this step if you are installing the W-IAP in
the United States or Japan.
Connecting aW-IAP
Based on the type of the power source that is used, perform one of the following steps to connect
the W-IAP to the power source:
lPoE switch— Connect the ENET 0 port of the W-IAP to the appropriate port on the PoE
switch.
lPoE midspan— Connect the ENET 0 port of W-IAP to the appropriate port on the PoE
midspan.
lAC to DC power adapter— Connect the 12V DC power jack socket to the AC to DC power
adapter.
Assigning an IP Address to the W-IAP
The W-IAP needs an IP address for network connectivity. When you connect the W-IAP to a
network, the W-IAP receives an IP address from a DHCP server.
To get an IP address for aW-IAP:
1. Connect the ENET 0 port of W-IAP to a switch or router using an Ethernet cable. Ensure that
the DHCP service is enabled on the network.
2. Connect the W-IAP to a power source. The W-IAP receives an IP address provided by the
switch or router.
NOTE: If there is no DHCP service on the network, the W-IAP can be assigned a static IP
address. If that doesn't happen, the W-IAP will get auto-assigned an IP within the 169.254
subnet.
Connecting to a Provisioning Wi-Fi Network
To connect to a provisioning Wi-Fi network:
1. Connect a wireless enabled client to a provisioning Wi-Fi network. The provisioning network
is called instant.
2. In the Microsoft Windows operating system, click the wireless network connection icon in the
system tray.
The Wireless Network Connection window appears.
3. Click on the instant network and click Connect.
4. In the Mac OS, click the AirPort icon. A list of available Wi-Fi networks is displayed.
5. Click on the instant network.

NOTE: Instant SSIDs are only broadcasted in 2.4 GHz.
NOTE: While connecting to the provisioning Wi-Fi network, ensure that the client is not
connected to any wired network.
Figure 1 - Connecting to a provisioning Wi-Fi Network — Microsoft Windows
Figure 2 - Connecting to a provisioning Wi-Fi Network — Mac OS
Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide 19 |Initial Configuration

20 |Initial Configuration Dell PowerConnect W-Series Instant Access Point 6.2.0.0-3.2.0.0 |User Guide
Disabling the Provisioning Wi-Fi Network
The provisioning network is enabled by default. Instant provides the option to disable the
provisioning network in APBoot through console. Use this option when you do not want the
default SSID instant to appear in your network.
To disable the provisioning network:
1. Connect a terminal or PC/workstation running a terminal emulation program to the Console
port on the W-IAP.
2. Configure the terminal or terminal emulation program to use the following communication
settings.
3. Power on the W-IAP. You see an autoboot countdown prompt that allows you to interrupt
the normal startup process and access APBoot.
4. Click Enter before the timer expires. The W-IAP goes into apboot mode through console.
Baud Rate Data Bits Parity Stop Bits Flow Control
9600 8 None 1 None
Table 2 - Terminal Communication Settings
5. In the apboot mode, use the following commands to disable the provisioning network:
napboot> factory_reset
napboot> setenv disable_prov_ssid 1
napboot> saveenv
napboot> reset
Assigning a Static IP
To assign a static IP to aW-IAP using APBoot:
1. Connect a terminal or PC/workstation running a terminal emulation program to the Console
port on the W-IAP.
2. Configure the terminal or terminal emulation program to use the following communication
settings.
3. Power on the W-IAP. You see an autoboot countdown prompt that allows you to interrupt
the normal startup process and access APBoot.
4. Click Enter before the timer expires. The W-IAP goes into apboot mode through console.
5. In the apboot mode, use the following commands to assign a static IP to aW-IAP.
Hit <Enter> to stop autoboot: 0
apboot>
apboot> setenv ipaddr 10.1.1.1
apboot> setenv netmask 255.255.255.0
apboot> setenv gatewayip 10.1.1.254
apboot> save
Saving Environment to Flash...
Un-Protected 1 sectors
.done
Erased 1 sectors
Writing
Use the printenv command to view the configuration.
apboot> printenv